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Claims 



The claimed invention is: 

1 . A method for providing multi-user file storage comprising the steps of: 

(a) enabling each user of a pre-subscribed user group of one or more users to connect 
an arbitrary client node at an arbitrary geographic location to a remote file server node via a wide 
area network, 

(b) enabling each user of the pre-subscribed user group to access the files of the file 
group via the respective client node connected to the remote file server node via the wide area 
network, including permitting more than one user of the pre-subscribed user group to access the 
file group at the remote file server node simultaneously, 

(c) maintaining the integrity of the files at the remote file server node by controlling 
each access to each of the files at the remote file server node so that each access to each the files 
at the remote file server is performed, if at all, on a respective portion of the respective file as 
most recently updated at the remote file server node, thereby enabling all native operating system 
application programming interfaces to operate so that all multi-user applications accessing the 
files function as if the remote server, which stores the files, and client nodes, at which such 
multi-user applications execute, were on the same local area network, and 

(d) delegating access control to a particular file of the group of files to an access 
control node. 

2. The method of claim 1 further comprising the steps of: 

(e) requesting at a particular client node access to one of the files of the group of files, 



and 



-73- 



(f) if the one file is the particular file, accessing the particular file at the particular 
client node only if permitted by the access control node. 

3. The method of claim 2 further comprising the steps of: 

(g) issuing the request from the particular client node to the remote file server node, 

and 

(h) in response to determining that the one file is the particular file, forwarding the 
request to the access control node. 

4. The method of claim 3 further comprising the step of: 

(i) in response to receiving at the particular client node a response from the access 
control node, issuing further messages pertaining to the access of the particular file directly from 
the particular client node to the access control node. 

5. The method of claim 1 further comprising the step of: 

(e) delegating version control of the particular file to a version control node. 

6. The method of claim 5 further comprising the steps of: 

(f) requesting, at a particular client node, for confirmation that at least a part of a 
particular copy of the particular file is the most updated version of the respective part of the 
particular copy of the file, and 

(g) accessing the part of the particular copy of the particular file only if permitted by 
the version control node. 
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7. The method of claim 6 wherein the particular client node stores the part of the particular copy 
in a storage device which is physically located locally to the particular client node. 

8. The method of claim 6 further comprising the steps of: 

(h) issuing a request for confirming that at least a part of the particular file is the most 
updated version, from the particular client node to the remote file server node, and 

(i) in response to determining that the one file is the particular file, forwarding the 
message to the version control node. 

9. The method of claim 8 further comprising the step of: 

(j) in response to receiving a response from the version control node at the particular 
client node, issuing further messages pertaining to version of the particular file directly from the 
particular client node to the version control node. 

10. The method of claim 9 wherein in response to modifying the particular file, the particular 
client node issues to the version control node a version update message for the file indicating a 
recent update has occurred on the particular file. 

1 1 . The method of claim 5 wherein the version control node is also the access control node for 
the particular file. 

12. The method of claim 1 further comprising the step of: 
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(e) while a particular client node is in communication with the remote file server 
node, selectively downloading from the remote file server node to the particular client node via 
the wide area network a copy of at least a most recently updated portion of a particular file to be 
accessed by the particular client node and which the particular client node lacks, wherein at all 
times, each client node in communication with the remote file server node adheres to explicit and 
implicit file sharing modes specified by the native file application programming interfaces. 

13. The method of claim 12 further comprising the steps of: 

(f) if the particular client node modifies the particular file while the particular client 
node is in communication with the remote file server node via the wide area network, uploading 
from the particular client node information for updating the copy of the particular file stored at 
the remote file server node for effecting the modifications to the particular file. 

14. The method of claim 13 further comprising the step of effecting the modifications by storing 
an incremental change to the copy of the particular file on the remote file server node. 

15. The method of claim 13 further comprising the step of effecting the modifications by 
over-writing at the remote file server node the current copy of the particular file with a copy of 
the particular file as updated by the modifications. 

16. The method of claim 13 further comprising the step of: 

(g) if a hoarding client node in communication with the remote file server node has 
indicated that it desires to hoard the particular file, then automatically downloading from the 
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remote file server node to the hoarding client node the information for updating the copy of the 
particular file in response to the particular client node uploading the information for updating the 
copy of the particular file stored at the remote file server, 

17. The method of claim 12 further comprising the steps of: 

(f) if the particular client node closes its communication channel with the remote file 
server node before closing the particular file then relinquishing the particular file at the remote 
file server node and enabling other client nodes in communication with the remote file server via 
the wide area network to access the particular file. 

18. The method of claim 12 further comprising the steps of: 

(f) closing the communication channel between the particular client node and the 
remote file server node; and 

(g) enabling the particular client node to access the downloaded copy of the particular 
file while out of communication with the remote file server node. 

19. The method of claim 18 further comprising the step of: 

(h) if the particular client node modifies the downloaded copy of the particular file 
while out of communication with the remote file server node, then selectively enabling or 
preventing the updating of the copy of the particular file on the remote file server node according 
to modification information transparently and automatically uploaded from the particular client 
node when the particular client node re-establishes communication with the remote file server 
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node via the wide area network, depending on the current modification status of the copy of the 
particular file at the remote file server node. 

20. The method of claim 19 further comprising the steps of: 

(i) selectively placing in a conflict bin associated only with, and maintained at, the 
particular client node information that depends on either: 

(I) modifications to the downloaded copy of the particular file, made by the 
client node while out of communication with the remote file server node; or 

(II) modifications to the copy of the particular file at the remote file server 
node, made while the client node was out of communication with the remote file server node, 

depending on the type of the modifications to the downloaded copy and the type 
of the modifications to the copy at the remote file server node. 

21. The method of claim 12 further comprising the step of: 

(f) in response to determining that another client node has modified the particular file 
at the remote file server node, after the particular client node has downloaded the copy of the 
particular file, selectively invalidating the downloaded copy of the particular file at the particular 
client node, depending on the modification status of the copy of the particular file at the remote 
file server node. 

22. The method of claim 21 further comprising the step of: 

(g) downloading from the remote file server node to the particular client node the 
valid copy of the file as modified by the other client node and enabling access by the particular 
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client node to the valid downloaded copy of the particular file in lieu of the invalid downloaded 
copy of the particular file. 

23. The method of claim 21 further comprising the steps of: 

(g) prior to step (e) 5 closing the communication channel between the particular client 
node and the remote file server node, and 

(h) prior to step (e), re-establishing communication between the particular client node 
and the remote file server node. 

24. The method of claim 1 further comprising the step of: 

(e) transparently to, and without specific action of, one of the users of a first client 
node in communication with the remote file server node via the wide area network, downloading 
from the remote file server node via the wide area network to the first client node modifications 
to a copy of a particular file maintained at the remote file server node, wherein the modifications 
were made by another client node. 

25. The method of claim 1 further comprising the step of: 

(e) providing an interface for adapting file access at a particular client node by 
designating at the particular client node each one or more of the accessible files of the file group 
as stored on a virtual storage device, and enabling access to the designated files in a fashion 
which is indistinguishable, by users of, and applications executing at, the first client node, with 
access to one or more files stored on a physical storage device that is locally present at the first 
client node. 
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26. The method of claim 25 further comprising the steps of: 

(f) storing on a storage device which is physically present locally to the particular 
client node a copy of each one or more of the designated accessible files, 

(g) if a user of, or an application executing at, the first client node, attempts to access 
a designated accessible file then: 

(I) accessing the valid copy of the designated accessible file stored in the 
locally physically present storage device, if a valid copy of the designated accessible file, for 
which access is attempted, is stored at the locally physically present storage device, and 

(II) downloading from the remote file server node to the particular client node 
via the wide area network, a copy of the designated accessible file and performing the access on 
the downloaded copy, if no valid copy of the designated accessible file, for which access is 
attempted, is stored at the locally physically present storage device. 

27. The method of claim 12 further comprising the step of: 

(f) preventing another client node from contemporaneously accessing a copy of the 
particular file according to a file sharing access mode which is incompatible to the file sharing 
access modes currently available to the particular client node for accessing the particular file. 

28. The method of claim 1 further comprising the step of: 

(e) depending on the granularity of file sharing to which applications, executing on a 
group of two or more client nodes, adhere, permitting applications of each client node of the 
group to simultaneously access the same one of the files. 
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29. The method of claim 28 wherein certain files are not accessed directly by each client node, 
the method further comprising the step of: 

(f) enabling each client to contemporaneously indirectly access such certain files 
through an intermediary node which performs each such access directly on behalf of the client 
nodes. 

30. The method of claim 1 further comprising the steps of: 

(e) transmitting a message to an internet email address of a user inviting the user to 
join the pre-subscribed user group, and 

(f) using the information in the message, issuing a request to join the pre-subscribed 
user group from a client node operated by the user. 

3 1 . The method of claim 30 wherein in the step of using the information in the message, the 
message being usable only once to join the pre-subscribed user group. 

32. The method of claim 1 further comprising the step of: 

(e) authenticating a connection between a particular client node and the remote file 
server node so that the particular client node verifies the identity of the remote server node, and 
the remote server node verifies the identity of the user of the particular client node. 

33. The method of claim 32 further comprising the step of: 

(f) encrypting data of a file at the particular client node using an encryption 
methodology known to the client node but not known to the remote file server node, 
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uploading the encrypted data to the remote file server node, and 
storing the encrypted file data at the remote file server node. 



34. The method of claim 33 further comprising the steps of: 

(i) encrypting the file at the particular client node using a data key known only to the 
client node, 

(j) encrypting the data key using a public key, 

(k) transmitting the encrypted data key to the remote file server node, and 
(1) storing the encrypted data key at the remote file server node, wherein the remote 
file server node lacks the private key necessary to decrypt the data key. 



35. The method of claim 34 further comprising the steps of: 

(m) encrypting the data key at the particular client node using a second public key 

associated with another user of the pre-subscribed user group, 

(n) transmitting the second encrypted data key to the remote file server node, and 
(o) storing the second encrypted data key at the remote file server node, wherein both 

the particular client node and the remote file server node lack the private key necessary to decrypt 

the data key. 



36. The method of claim 33 further comprising the steps of: 

(i) at the remote file server node, retrieving from storage the encrypted data of a 
particular file, 

(j) transmitting the encrypted data to a specific client node, 
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(k) using a decryption methodology known to the specific client node but not known 
at the remote file server node, decrypting the data. 

37. The method of claim 32 further comprising the steps of: 

(f) receiving at the remote file server node, a request from a specific client node to 
access a particular file, 

(g) determining at the remote file server node whether or not the particular access 
requested by the specific client node is permitted by privilege access rights associated with the 
particular file, and 

(h) only permitting the access to the particular file by the specific client node if 
permitted by the privilege access rights associated with the particular file. 

38. The method of claim 1 further comprising the steps of: 

(e) receiving at the remote file server node, a request from a specific client node to 
access a particular file, 

(f) determining at the remote file server node whether or not the particular access 
requested by the specific client node is permitted by privilege access rights associated with the 
particular file, and 

(g) only permitting the access to the particular file by the specific client node if 
permitted by the privilege access rights associated with the particular file. 

39. The method of claim 1 further comprising the steps of: 
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(e) transferring an encrypted key from the remote file server node to a particular 
client nodes via a secure channel, the key being encrypted using an encryption function not 
known locally at the remote file server node, 

(f) decrypting the transferred key at the particular client node, and 

(g) using the key at the particular client node to decrypt information of a file 
downloaded from the remote file server node or to encrypt information of a file prior to 
uploading for storage at the remote file server node. 

40. The method of claim 39 further comprising the step of: 

(h) compressing the information of the file prior to uploading the file or 
decompressing the information of the file subsequent to downloading the file. 

^1 . The method of claim 1 further comprising the step of: 

(e) compressing the information of the file prior to uploading the file or 
decompressing the information of the file subsequent to downloading the file. 

42. The method of claim 1 further comprising the steps of: 

(e) enabling each user of another pre-subscribed user group of one or more users to 
access another group of files via a respective client node in communication with the remote 
server node via the wide area network, wherein each pre-subscribed user group includes a 
different subset of users but also have at least one particular user in common, 

wherein the particular user is able to contemporaneously access files in each group. 
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43. The method of claim 1 further comprising the step of: 

(e) enabling the users to access one or more of the files at one or more additional file 
server nodes. 

44. The method of claim 43 wherein a particular client node is capable of communicating with 
the additional file server nodes remotely via a wide area network, the method further comprising 
the step of: 

(f) the particular client node accessing a copy of a particular file on one of the remote 
file server node or a particular additional file server node which is most efficient for the 
particular client node. 

45. The method of claim 43 wherein a particular client node is capable of communicating with at 
least a particular additional file server node via a local area network, the method further 
comprising the step of: 

(f) the particular client node accessing a copy of a particular file at the particular 
additional file server node via the local area network. 

46. A method for providing multi-user file storage comprising the steps of: 

(a) enabling each user of a pre-subscribed user group of one or more users operating 
an arbitrary client node at an arbitrary geographic location to communicate with a remote file 
server node via a wide area network, 

(b) enabling each user of the pre-subscribed user group to access the files of the file 
group via the respective client node in communication with the remote file server node via the 
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wide area network, including permitting more than one user of the pre-subscribed user group to 
access the file group at the remote file server node simultaneously, 

(c) providing an interface for adapting file access at a particular client node by 
designating at the particular client node each accessible file of the file group as stored on a virtual 
storage device, and enabling access to the designated files in a fashion which is indistinguishable, 
by users of, and applications executing at, the particular client node, with access to one or more 
files stored on a physical storage device that is locally present at the particular client node, and 

(d) delegating access control to a particular file of the group of files to an access 
control node. 

47. The method of claim 46 further comprising the steps of: 

(e) requesting at a particular client node access to one of the files of the group of files, 

and 

(f) if the one file is the particular file, accessing the particular file at the particular 
client node only if permitted by the access control node. 

48. The method of claim 47 further comprising the steps of: 

(g) issuing the request from the particular client node to the remote file server node, 

and 

(h) in response to determining that the one file is the particular file, forwarding the 
request to the access control node. 



49. The method of claim 48 further comprising the step of: 
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(i) in response to receiving at the particular client node a response from the access 
control node, issuing further messages pertaining to the access of the particular file directly from 
the particular client node to the access control node. 

50. The method of claim 46 further comprising the step of: 

(e) delegating version control of the particular file to a version control node. 

5 1 . The method of claim 50 further comprising the steps of: 

(f) requesting, at a particular client node, for confirmation that at least a part of a 
particular copy of the particular file is the most updated version of the respective part of the 
particular copy of the file, and 

(g) accessing the part of the particular copy of the particular file only if permitted by 
the version control node. 

52. The method of claim 5 1 wherein the particular client node stores the part of the particular 
copy in a storage device which is physically located locally to the particular client node. 

53. The method of claim 51 further comprising the steps of: 

(h) issuing a request for confirming that at least a part of the particular file is the most 
updated version, from the particular client node to the remote file server node, and 

(i) in response to determining that the one file is the particular file, forwarding the 
message to the version control node. 
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54. The method of claim 53 further comprising the step of: 

(j) in response to receiving a response from the version control node at the particular 
client node, issuing further messages pertaining to version of the particular file directly from the 
particular client node to the version control node. 

55. The method of claim 54 wherein in response to modifying the particular file, the particular 
client node issues to the version control node a version update message for the file indicating a 
recent update has occurred on the particular file. 

56. The method of claim 50 wherein the version control node is also the access control node for 
the particular file. 

57. The method of claim 46 further comprising the steps of: 

(e) storing on a storage device which is physically present locally to the particular 
client node a copy of one or more of the designated files, 

(f) if a user of, or an application executing at, the particular client node, attempts to 
access a designated accessible file then: 

(I) accessing the valid copy of the designated file stored in the locally 
physically present storage device, if a valid copy of the designated file, for which access is 
attempted, is stored at the locally physically present storage device, and 

(II) downloading from the remote file server node to the particular client node 
via the wide area network, a copy of the designated file and performing the access on the 
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downloaded copy, if no valid copy of the designated file, for which access is attempted, is stored 
at the locally physically present storage device. 

58. The method of claim 57 further comprising the step of: 

(g) preventing another client node from contemporaneously accessing a copy of the 
particular file according to a file sharing access mode which is incompatible to the file sharing 
access modes currently available to the particular client node for accessing the particular file. 

59. The method of claim 58 further comprising the step of: 

(h) depending on the granularity of file sharing to which applications, executing on a 
group of two or more client nodes, adhere, permitting applications of each client node of the 
group to simultaneously access the same file. 

60. The method of claim 59 wherein certain files are not accessed directly by each client node, 
the method further comprising the step of: 

(i) enabling each client to contemporaneously indirectly access such certain files 
through an intermediary node which performs each such access directly on behalf of the client 
nodes. 

61 . The method of claim 58 further comprising the steps of: 

(h) transmitting a message to an internet email address of a user inviting the user to 
join the pre-subscribed user group, and 
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(i) using the information in the message, issuing a request to join the pre-subscribed 
user group from a client node operated by the user. 

62. The method of claim 61 wherein in the step of using the information in the message, the 
message being usable only once to join the pre-subscribed user group. 

63. The method of claim 46 further comprising the step of: 

(e) authenticating a connection between a particular client node and the remote file 
server node so that the particular client node verifies the identity of the remote server node, and 
the remote server node verifies the identity of the user of the particular client node. 

64. The method of claim 63 further comprising the step of: 

(f) encrypting data of a file at the particular client node using an encryption 
methodology known to the client node but not known to the remote file server node, 

(g) uploading the encrypted data to the remote file server node, and 

(h) storing the encrypted file data at the remote file server node. 

65. The method of claim 64 further comprising the steps of: 

(i) encrypting the file at the particular client node using a data key known only to the 
client node, 

(j) encrypting the data key using a public key, 

(k) transmitting the encrypted data key to the remote file server node, and 
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(1) storing the encrypted data key at the remote file server node, wherein the remote 
file server node lacks the private key necessary to decrypt the data key. 

66. The method of claim 65 further comprising the steps of: 

(m) encrypting the data key at the particular client node using a second public key 

associated with another user of the pre-subscribed user group, 

(n) transmitting the second encrypted data key to the remote file server node, and 
(o) storing the second encrypted data key at the remote file server node, wherein both 

the particular client node and the remote file server node lack the private key necessary to decrypt 

the data key. 

67. The method of claim 63 further comprising the steps of: 

(f) at the remote file server node, retrieving from storage the encrypted data of a 
particular file, 

(g) transmitting the encrypted data to a specific client node, and 

(h) using a decryption methodology known to the specific client node but not known 
at the remote file server node, decrypting the data. 

68. The method of claim 63 further comprising the steps of: 

(f) receiving at the remote file server node, a request from a specific client node to 
access a particular file, 
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(g) determining at the remote file server node whether or not the particular access 
requested by the specific client node is permitted by privilege access rights associated with the 
particular file, and 

(h) only permitting the access to the particular file by the specific client node if 
permitted by the privilege access rights associated with the particular file. 

69. The method of claim 46 further comprising the steps of: 

(e) receiving at the remote file server node, a request from a specific client node to 
access a particular file, 

(f) determining at the remote file server node whether or not the particular access 
requested by the specific client node is permitted by privilege access rights associated with the 
particular file, and 

(g) only permitting the access to the particular file by the specific client node if 
permitted by the privilege access rights associated with the particular file. 

70. The method of claim 46 further comprising the steps of: 

(e) transferring an encrypted key from the remote file server node to a particular 
client nodes via a secure channel, the key being encrypted using an encryption function not 
known locally at the remote file server node, 

(f) decrypting the transferred key at the particular client node, and 

(g) using the key at the particular client node to decrypt information of a file 
downloaded from the remote file server node or to encrypt information of a file prior to 
uploading for storage at the remote file server node. 
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71 . The method of claim 70 further comprising the step of: 

(h) compressing the information of the file prior to uploading the file or 
decompressing the information of the file subsequent to downloading the file. 

72. The method of claim 46 further comprising the step of: 

(e) compressing the information of the file prior to uploading the file or 
decompressing the information of the file subsequent to downloading the file. 

73. The method of claim 46 further comprising the steps of: 

(e) enabling each user of another pre-subscribed user group of one or more users to 
access another group of files via a respective client node in communication with the remote 
server node via the wide area network, wherein each pre-subscribed user group includes a 
different subset of users but also have at least one particular user in common, 

wherein the particular user is able to contemporaneously access files in each group. 

74. The method of claim 46 further comprising the step of: 

(e) enabling the users to access one or more of the files at one or more additional file 
server nodes. 

75. The method of claim 74 wherein a particular client node is capable of communicating with 
the additional file server nodes remotely via a wide area network, the method further comprising 
the step of: 
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(f) the particular client node accessing a copy of a particular file on one of the remote 
file server node or a particular additional file server node which is most efficient for the 
particular client node. 

76. The method of claim 74 wherein a particular client node is capable of communicating with at 
least a particular additional file server node via a local area network, the method further 
comprising the step of: 

(f) the particular client node accessing a copy of a particular file at the particular 
additional file server node via the local area network. 

77. A method for providing multi-user file storage comprising the steps of: 

(a) enabling each user of a pre-subscribed user group of one or more users operating 
an arbitrary client node at an arbitrary geographic location to communicate with a remote file 
server node via a wide area network, 

(b) enabling each user of the pre-subscribed user group to access the files of the file 
group via the respective client node in communication with the remote file server node via the 
wide area network, including permitting more than one user of the pre-subscribed user group to 
access the file group at the remote file server node simultaneously, 

(c) transferring an encrypted key from the remote file server node to a particular 
client node via a secure channel, the key being encrypted using an encryption function not known 
locally at the remote file server node, 

(d) decrypting the transferred key at the particular client node, 
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(e) using the key at the particular client node to decrypt information of a file 
downloaded from the remote file server node or to encrypt information of a file prior to 
uploading for storage at the remote file server node, and 

. (f) delegating access control to a particular file of the group of files to an access 
control node. 

78. The method of claim 77 further comprising the steps of: 

(g) requesting at a particular client node access to one of the files of the group of files, 

and 

(h) if the one file is the particular file, accessing the particular file at the particular 
client node only if permitted by the access control node. 

79. The method of claim 78 further comprising the steps of: 

(i) issuing the request from the particular client node to the remote file server node, 

and 

0) in response to determining that the one file is the particular file, forwarding the 
request to the access control node. 

80. The method of claim 79 further comprising the step of: 

(k) in response to receiving at the particular client node a response from the access 
control node, issuing further messages pertaining to the access of the particular file directly from 
the particular client node to the access control node. 
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81 . The method of claim 77 further comprising the step of: 

(g) delegating version control of the particular file to a version control node. 

82. The method of claim 81 further comprising the steps of: 

(h) requesting, at a particular client node, for confirmation that at least a part of a 
particular copy of the particular file is the most updated version of the respective part of the 
particular copy of the file, and 

(i) accessing the part of the particular copy of the particular file only if permitted by 
the version control node. 

83. The method of claim 82 wherein the particular client node stores the part of the particular 
copy in a storage device which is physically located locally to the particular client node. 

84. The method of claim 82 further comprising the steps of: 

(j) issuing a request for confirming that at least a part of the particular file is the most 
updated version, from the particular client node to the remote file server node, and 

(k) in response to determining that the one file is the particular file, forwarding the 
message to the version control node. 

85. The method of claim 84 further comprising the step of: 

(1) in response to receiving a response from the version control node at the particular 
client node, issuing further messages pertaining to version of the particular file directly from the 
particular client node to the version control node. 
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86. The method of claim 85 wherein in response to modifying the particular file, the particular 
client node issues to the version control node a version update message for the file indicating a 
recent update has occurred on the particular file. 

87. The method of claim 81 wherein the version control node is also the access control node for 
the particular file. 

88. The method of claim 77 further comprising the step of: 

(g) compressing the information of the file prior to uploading the file or 
decompressing the information of the file subsequent to downloading the file. 

89. A system for providing multi-user file storage comprising the steps of: 

a remote file server node for enabling each user of a pre-subscribed user group of one or 
more users to connect an arbitrary client node at an arbitrary geographic location to communicate 
with said remote file server node via a wide area network, 

a storage device at the remote file server node for enabling each user of the 
pre-subscribed user group to access the files of the file group via the respective client node in 
communication with the remote file server node via the wide area network, including permitting 
more than one user of the pre-subscribed user group to access the file group at the remote file 
server node simultaneously, and 

wherein the remote file server node is also for maintaining the integrity of the files 
at the remote file server node by controlling each access to each of the files at the remote file 
server node so that each access to each the files at the remote file server is performed, if at all, on 
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a respective portion of the respective file as most recently updated at the remote file server node, 
thereby enabling all native operating system application programming interfaces to operate so 
that all multi-user applications accessing the files function as if the remote server, which stores 
the files, and client nodes, at which such multi-user applications execute, were on the same local 
area network, and 

wherein the remote file server node is also for delegating access control to a 
particular file of the group of files to an access control node. 

90. The system of claim 89 wherein a particular client node requests access to one of the files of 
the group of files, and 

wherein if the one file is the particular file, accessing the particular file at the particular 
client node only if permitted by the access control node. 

91 . The system of claim 90 wherein the particular client node issues the request to the remote 
file server node, and 

wherein the remote file server node forwards the request to the access control node in 
response to determining that the one file is the particular file . 

92. The system of claim 91 wherein the particular client node, in response to receiving a 
response from the access control node, issues further messages pertaining to the access of the 
particular file directly from the particular client node to the access control node. 
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93. The system of claim 89 wherein the remote file server node delegates version control of the 
particular file to a version control node. 

94. The system of claim 93 wherein a particular client node requests confirmation that at least a 
part of a particular copy of the particular file is the most updated version of the respective part of 
the particular copy of the file, and 

wherein the particular client node accesses the part of the particular copy of the particular 
file only if permitted by the version control node. 

95. The system of claim 94 wherein the particular client node stores the part of the particular 
copy in a storage device which is physically located locally to the particular client node. 

96. The system of claim 94 wherein the particular client node issues a request to the remote file 
server node to confirm that at least a part of the particular file is the most updated version, and 

wherein the remote file server node, in response to determining that the one file is the 
particular file, forwards the message to the version control node. 

97. The system of claim 96 wherein the particular client node, in response to receiving a 
response from the version control node, issues further messages pertaining to version of the 
particular file directly from the particular client node to the version control node. 
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98. The system of claim 97 wherein in response to modifying the particular file, the particular 
client node issues to the version control node a version update message for the file indicating a 
recent update has occurred on the particular file. 

99. The system of claim 93 wherein the version control node is also the access control node for 
the particular file. 

100. The system of claim 89 wherein the remote file server node is also configured for 
selectively downloading from the remote file server node to the particular client node via the 
wide area network a copy of at least a most recently updated portion of a particular file to be 
accessed by the particular client node and which the particular client node lacks, while a 
particular client node is in communication with the remote file server node, wherein at all times, 
each client node in communication with the remote file server node adheres to explicit and 
implicit file sharing modes specified by the native file application programming interfaces. 

101 . The system of claim 1 00 wherein the remote file server node is also configured for 
uploading from the particular client node information for updating the copy of the particular file 
stored at the remote file server node for effecting the modifications to the particular file, if the 
particular client node modifies the particular file while the particular client node is in 
communication with the remote file server node via the wide area network. 
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102. The system of claim 101 wherein the remote file server node is also configured for 
effecting the modifications by storing an incremental change to the copy of the particular file on 
the remote file server node. 

103. The system of claim 101 wherein the remote file server node is also configured for 
effecting the modifications by over-writing at the remote file server node the current copy of the 
particular file with a copy of the particular file as updated by the modifications. 

104. The system of claim 101 wherein the remote file server is also configured for automatically 
downloading from the remote file server node to a hoarding client node the information for 
updating the copy of the particular file in response to the particular client node uploading the 
information for updating the copy of the particular file stored at the remote file server, if the 
hoarding client node in communication with the remote file server node has indicated that it 
desires to hoard the particular file. 

105. The system of claim 100 wherein the remote file server node is also configured for 
relinquishing the particular file at the remote file server node and enabling other client nodes in 
communication with the remote file server via the wide area network to access the particular file, 
if the particular client node closes its communication channel with the remote file server node 
before closing the particular file. 

106. The system of claim 100 further comprising: 
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a particular client node for closing the communication channel between the 
particular client node and the remote file server node, 

wherein the remote file server node is also for enabling the particular client node 
to access the downloaded copy of the particular file while out of communication with the remote 
file server node. 

107. The system of claim 106 wherein the remote file server node is also configured for 
selectively enabling or preventing the updating of the copy of the particular file on the remote file 
server node according to modification information transparently and automatically uploaded 
from the particular client node when the particular client node re-establishes communication with 
the remote file server node via the wide area network, if the particular client node modifies the 
downloaded copy of the particular file while out of communication with the remote file server 
node, depending on the current modification status of the copy of the particular file at the remote 
file server node. 

108. The system of claim 107 wherein the particular client node is also configured for selectively 
placing in a conflict bin associated only with, and maintained at, the particular client node 
information that depends on either: 

(I) modifications to the downloaded copy of the particular file, made by the 
client node while out of communication with the remote file server node; or 

(II) modifications to the copy of the particular file at the remote file server 
node, made while the client node was out of communication with the remote file server node, 
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depending on the type of the modifications to the downloaded copy and the type 
of the modifications to the copy at the remote file server node. 

109. The system of claim 100 wherein the remote file server node is also configured for 
selectively invalidating the downloaded copy of the particular file at the particular client node, 
depending on the modification status of the copy of the particular file at the remote file server 
node, in response to determining that another client node has modified the particular file at the 
remote file server node, after the particular client node has downloaded the copy of the particular 
file. 

110. The system of claim 109 wherein the remote file server node is also configured for 
downloading to the particular client node the valid copy of the file as modified by the other client 
node and enabling access by the particular client node to the valid downloaded copy of the 
particular file in lieu of the invalid downloaded copy of the particular file. 

111. The system of claim 109 further comprising : 

a particular client node for closing the communication channel between the 
particular client node and the remote file server node, and re-establishing communication 
between the particular client node and the remote file server node prior to determining whether or 
not to invalidate the downloaded copy of the file. 

112. The system of claim 89 wherein the remote file server node is also configured for 
transparently to, and without specific action of, one of the users of a first client node in 
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communication with the remote file server node via the wide area network, downloading from 
the remote file server node via the wide area network to the first client node modifications to a 
copy of a particular file maintained at the remote file server node, wherein the modifications 
were made by another client node. 

113. The system of claim 89 further comprising: 

an interface for adapting file access at a particular client node by designating at 
the particular client node each one or more of the accessible files of the file group as stored on a 
virtual storage device, and enabling access to the designated files in a fashion which is 
indistinguishable, by users of, and applications executing at, the first client node, with access to 
one or more files stored on a physical storage device that is locally present at the first client node, 

1 14. The system of claim 1 13 further comprising: 

a local storage device, which is physically present locally to the first client node, 
for storing a copy of each one or more of the designated accessible files, 

wherein, if a user of, or an application executing at, the particular client node, 
attempts to access a designated accessible file then: 

(I) the local storage device accesses the valid copy of the designated 
accessible file stored in the local storage device, if a valid copy of the designated accessible file, 
for which access is attempted, is stored at the local storage device, and 

(II) the particular client node downloads from the remote file server node to 
the particular client node via the wide area network, a copy of the designated accessible file and 
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performing the access on the downloaded copy, if no valid copy of the designated accessible file, 
for which access is attempted, is stored at the local storage device. 

115. The system of claim 100 further comprising: 

another client node for refraining from contemporaneously accessing a copy of the 
particular file according to a file sharing access mode which is incompatible to the file sharing 
access modes currently available to the particular client node for accessing the particular file. 

116. The system of claim 89 further comprising: 

a plurality of applications executing on a group of two or more client nodes which 
are permitted to simultaneously access the same file, depending on the granularity of file sharing 
to which the applications adhere. 

117. The system of claim 116 wherein certain files are not accessed directly by each client node, 
and wherein each client is enabled to contemporaneously indirectly access such certain files 
through an intermediary node which performs each such access directly on behalf of the client 
nodes. 

1 1 8. The system of claim 89 further comprising: 

a manager node for transmitting a message to an Internet email address of a user 
inviting the user to join the pre-subscribed user group, and 

a client node operated by the user for issuing a request to join the pre-subscribed 
user group using the information in the message. 
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119. The method of claim 118 wherein the message being usable only once to join the 
pre-subscribed user group. 

120. The system of claim 89 further comprising: 

a particular client node, wherein both the particular client node and remote server 
node are configured for authenticating a connection between a particular client node and the 
remote file server node so that the particular client node verifies the identity of the remote server 
node, and the remote server node verifies the identity of the user of the particular client node. 

121. The system of claim 120 wherein the client node is further configured for encrypting data 
of a file at the particular client node using an encryption methodology known to the client node 
but not known to the remote file server node, and for uploading the encrypted data to the remote 
file server node, and wherein the storage device is further configured for storing the encrypted 
file data at the remote file server node. 

122. The system of claim 121 wherein the particular client node is further configured for 
encrypting the file at the particular client node using a data key known only to the client node, for 
encrypting the data key using a public key, and for transmitting the encrypted data key to the 
remote file server node, and wherein the storage device is further configured for storing the 
encrypted data key at the remote file server node, wherein the remote file server node lacks the 
private key necessary to decrypt the data key. 
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123. The system of claim 122 wherein the particular client node is further configured for 
encrypting the data key at the particular client node using a second public key associated with 
another user of the pre-subscribed user group, and for transmitting the second encrypted data key 
to the remote file server node, and wherein the storage device is further configured for storing the 
second encrypted data key at the remote file server node, wherein both the particular client node 
and the remote file server node lack the private key necessary to decrypt the data key. 

124. The system of claim 120 wherein the storage device is further configured for retrieving the 
encrypted data of a particular file, wherein the remote file server node is further configured for 
transmitting the encrypted data to a specific client node, and wherein the specific client node uses 
a decryption methodology known to the specific client node but not known at the remote file 
server node, for decrypting the data. 

125. The system of claim 120 wherein the remote file server node is further configured for 
receiving a request from a specific client node to access a particular file, for determining whether 
or not the particular access requested by the specific client node is permitted by privilege access 
rights associated with the particular file, and for only permitting the access to the particular file 
by the specific client node if permitted by the privilege access rights associated with the 
particular file. 

126. The system of claim 89 wherein the remote file server node is further configured for 
receiving a request from a specific client node to access a particular file, for determining whether 
or not the particular access requested by the specific client node is permitted by privilege access 
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rights associated with the particular file, and for only permitting the access to the particular file 
by the specific client node if permitted by the privilege access rights associated with the 
particular file. 

127. The system of claim 89 further comprising: 

a particular client node, 

wherein the remote file server node is further configured for transferring an 
encrypted key a particular client nodes via a secure channel, the key being encrypted using an 
encryption function not known locally at the remote file server node, 

wherein the particular client node is configured for decrypting the transferred key 
at the particular client node, and for using the key at the particular client node to decrypt 
information of a file downloaded from the remote file server node or to encrypt information of a 
file prior to uploading for storage at the remote file server node. 

128. The system of claim 127 wherein the particular client node is further configured for 
compressing the information of the file prior to uploading the file or for decompressing the 
information of the file subsequent to downloading the file. 

129. The system of claim 89 further comprising: 

a particular client node for compressing the information of the file prior to 
uploading the file or for decompressing the information of the file subsequent to downloading the 
file. 
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130. The system of claim 89 wherein the remote file server node is also configured for enabling 
each user of another pre-subscribed user group of one or more users to access another group of 
files via a respective client node in communication with the remote server node via the wide area 
network, wherein each pre-subscribed user group includes a different subset of users but also 
have at least one particular user in common, 

wherein the particular user is able to contemporaneously access files in each group. 

131. The system of claim 89 further comprising: 

one or more additional file server nodes at which the users are enabled to access 
one or more of the files. 

132. The system of claim 131 further comprising: 

a particular client node capable of communicating with the additional file server 
nodes remotely via a wide area network, and configured for accessing a copy of a particular file 
on one of the remote file server node or a particular additional file server node which is most 
efficient for the particular client node. 

133. The system of claim 131 further comprising: 

a particular client node capable of communicating with at least a particular 
additional file server node via a local area network, and configured for accessing a copy of a 
particular file at the particular additional file server node via the local area network. 



134. A system for providing multi-user file storage comprising: 
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a specific client node at an arbitrary geographic location, usable by a user of a 
pre-subscribed user group for communicating with a remote file server node via a wide area 
network, the remote file server enabling each user of the pre-subscribed user group to access the 
files of the file group via the respective client node in communication with the remote file server 
node via the wide area network, including permitting more than one user of the pre-subscribed 
user group to access the file group at the remote file server node simultaneously, and 

an interface for adapting file access at the specific client node by designating at 
the specific client node each accessible file of the file group as stored on a virtual storage device, 
and enabling access to the designated files in a fashion which is indistinguishable, by users of, 
and applications executing at, the specific client node, with access to one or more files stored on 
a physical storage device that is locally present at the specific client node, and 

wherein the remote file server node is also for delegating access control to a 
particular file of the group of files to an access control node. 

135. The system of claim 134 wherein a particular client node requests access to one of the files 
of the group of files, and 

wherein if the one file is the particular file, accessing the particular file at the particular 
client node only if permitted by the access control node. 

136. The system of claim 135 wherein the particular client node issues the request to the remote 
file server node, and 

wherein the remote file server node forwards the request to the access control node in 
response to determining that the one file is the particular file . 
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137. The system of claim 136 wherein the particular client node, in response to receiving a 
response from the access control node, issues further messages pertaining to the access of the 
particular file directly from the particular client node to the access control node. 

138. The system of claim 134 wherein the remote file server node delegates version control of 
the particular file to a version control node. 

139. The system of claim 138 wherein a particular client node requests confirmation that at least 
a part of a particular copy of the particular file is the most updated version of the respective part 
of the particular copy of the file, and 

wherein the particular client node accesses the part of the particular copy of the particular 
file only if permitted by the version control node. 

140. The system of claim 139 wherein the particular client node stores the part of the particular 
copy in a storage device which is physically located locally to the particular client node. 

141 . The system of claim 139 wherein the particular client node issues a request to the remote 
file server node to confirm that at least a part of the particular file is the most updated version, 
and 

wherein the remote file server node, in response to determining that the one file is the 
particular file, forwards the message to the version control node. 
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142. The system of claim 141 wherein the particular client node, in response to receiving a 
response from the version control node, issues further messages pertaining to version of the 
particular file directly from the particular client node to the version control node. 

143. The system of claim 142 wherein in response to modifying the particular file, the particular 
client node issues to the version control node a version update message for the file indicating a 
recent update has occurred on the particular file. 

144. The system of claim 138 wherein the version control node is also the access control node 
for the particular file. 

145. The system of claim 134 further comprising: 

a local storage device, which is physically present locally to the specific client 
node, for storing a copy of each one or more of the designated accessible files, 

wherein, if a user of, or an application executing at, the specific client node, 
attempts to access a designated accessible file then: 

(I) the local storage device accesses the valid copy of the designated 
accessible file stored in the local storage device, if a valid copy of the designated accessible file, 
for which access is attempted, is stored at the local storage device, and 

(II) the specific client node downloads from the remote file server node to the 
specific client node via the wide area network, a copy of the designated accessible file and 
performing the access on the downloaded copy, if no valid copy of the designated accessible file, 
for which access is attempted, is stored at the local storage device. 
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146. The system of claim 134 further comprising: 

another client node for refraining from contemporaneously accessing a copy of the 
particular file according to a file sharing access mode which is incompatible to the file sharing 
access modes currently available to a particular client node for accessing the particular file. 

147. The system of claim 134 further comprising: 

a plurality of applications executing on a group of two or more client nodes which 
are permitted to simultaneously access the same file, depending on the granularity of file sharing 
to which the applications adhere. 

148. The system of claim 147 wherein certain files are not accessed directly by each client node, 
and wherein each client is enabled to contemporaneously indirectly access such certain files 
through an intermediary node which performs each such access directly on behalf of the client 
nodes. 

149. The system of claim 134 further comprising: 

a manager node for transmitting a message to an Internet email address of a user 
inviting the user to join the pre-subscribed user group, and 

a client node operated by the user for issuing a request to join the pre-subscribed 
user group using the information in the message. 

150. The method of claim 149 wherein the message being usable only once to join the 
pre-subscribed user group. 
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151. The system of claim 145 further comprising: 

a particular client node, wherein both the particular client node and remote server 
node are configured for authenticating a connection between a particular client node and the 
remote file server node so that the particular client node verifies the identity of the remote server 
node, and the remote server node verifies the identity of the user of the particular client node. 

152. The system of claim 151 wherein the client node is further configured for encrypting data 
of a file at the particular client node using an encryption methodology known to the client node 
but not known to the remote file server node, and for uploading the encrypted data to the remote 
file server node, and wherein the storage device is further configured for storing the encrypted 
file data at the remote file server node. 

153. The system of claim 152 wherein the particular client node is further configured for 
encrypting the file at the particular client node using a data key known only to the client node, for 
encrypting the data key using a public key, and for transmitting the encrypted data key to the 
remote file server node, and wherein the storage device is further configured for storing the 
encrypted data key at the remote file server node, wherein the remote file server node lacks the 
private key necessary to decrypt the data key. 

154. The system of claim 153 wherein the particular client node is further configured for 
encrypting the data key at the particular client node using a second public key associated with 
another user of the pre-subscribed user group, and for transmitting the second encrypted data key 
to the remote file server node, and wherein the storage device is further configured for storing the 
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second encrypted data key at the remote file server node, wherein both the particular client node 
and the remote file server node lack the private key necessary to decrypt the data key. 

155. The system of claim 151 wherein the storage device is further configured for retrieving the 
encrypted data of a particular file, wherein the remote file server node is further configured for 
transmitting the encrypted data to a specific client node, and wherein the specific client node uses 
a decryption methodology known to the specific client node but not known at the remote file 
server node, for decrypting the data. 

156. The system of claim 151 wherein the remote file server node is further configured for 
receiving a request from a specific client node to access a particular file, for determining whether 
or not the particular access requested by the specific client node is permitted by privilege access 
rights associated with the particular file, and for only permitting the access to the particular file 
by the specific client node if permitted by the privilege access rights associated with the 
particular file. 

157. The system of claim 134 wherein the remote file server node is further configured for 
receiving a request from a specific client node to access a particular file, for determining whether 
or not the particular access requested by the specific client node is permitted by privilege access 
rights associated with the particular file, and for only permitting the access to the particular file 
by the specific client node if permitted by the privilege access rights associated with the 
particular file. 
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158. The system of claim 134 further comprising: 

a particular client node, 

wherein the remote file server node is further configured for transferring an 
encrypted key a particular client nodes via a secure channel, the key being encrypted using an 
encryption function not known locally at the remote file server node, 

wherein the particular client node is configured for decrypting the transferred key 
at the particular client node, and for using the key at the particular client node to decrypt 
information of a file downloaded from the remote file server node or to encrypt information of a 
file prior to uploading for storage at the remote file server node. 

159. The system of claim 158 wherein the particular client node is further configured for 
compressing the information of the file prior to uploading the file or for decompressing the 
information of the file subsequent to downloading the file. 

160. The system of claim 134 further comprising: 

a particular client node for compressing the information of the file prior to 
uploading the file or for decompressing the information of the file subsequent to downloading the 
file. 

161 . The system of claim 134 wherein the remote file server node is also configured for enabling 
each user of another pre-subscribed user group of one or more users to access another group of 
files via a respective client node in communication with the remote server node via the wide area 
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network, wherein each pre-subscribed user group includes a different subset of users but also 
have at least one particular user in common, 

wherein the particular user is able to contemporaneously access files in each group. 

162. The system of claim 134 further comprising: 

one or more additional file server nodes at which the users are enabled to access 
one or more of the files. 

163. The system of claim 162 further comprising: 

a particular client node capable of communicating with the additional file server 
nodes remotely via a wide area network, and configured for accessing a copy of a particular file 
on one of the remote file server node or a particular additional file server node which is most 
efficient for the particular client node. 

164. The system of claim 162 further comprising: 

a particular client node capable of communicating with at least a particular 
additional file server node via a local area network, and configured for accessing a copy of a 
particular file at the particular additional file server node via the local area network. 

165. A system for providing multi-user file storage comprising: 

a remote file server node for enabling each user of a pre-subscribed user group of 
one or more users operating an arbitrary client node at an arbitrary geographic location to 
communicate with a remote file server node via a wide area network, 
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a storage device at the remote file server node for enabling each user of the 
pre-subscribed user group to access the files of the file group via the respective client node in 
communication with the remote file server node via the wide area network, including permitting 
more than one user of the pre-subscribed user group to access the file group at the remote file 
server node simultaneously, and 

a particular client node, 

wherein the remote file server node is also configured for transferring an 
encrypted key from the remote file server node to a particular client node via a secure channel, 
the key being decryptable using a decryption function not known locally at the remote file server 
node, 

wherein the particular client node is also configured for decrypting the transferred 
key at the particular client node, and for using the key at the particular client node to decrypt 
information of a file downloaded from the remote file server node or to encrypt information of a 
file prior to uploading for storage at the remote file server node, and 

wherein the remote file server node is also for delegating access control to a 
particular file of the group of files to an access control node. 

166. The system of claim 165 wherein a particular client node requests access to one of the files 
of the group of files, and 

wherein if the one file is the particular file, accessing the particular file at the particular 
client node only if permitted by the access control node. 
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167. The system of claim 166 wherein the particular client node issues the request to the remote 
file server node, and 

wherein the remote file server node forwards the request to the access control node in 
response to determining that the one file is the particular file . 

168. The system of claim 167 wherein the particular client node, in response to receiving a 
response from the access control node, issues further messages pertaining to the access of the 
particular file directly from the particular client node to the access control node. 

169. The system of claim 165 wherein the remote file server node delegates version control of 
the particular file to a version control node. 

170. The system of claim 169 wherein a particular client node requests confirmation that at least 
a part of a particular copy of the particular file is the most updated version of the respective part 
of the particular copy of the file, and 

wherein the particular client node accesses the part of the particular copy of the particular 
file only if permitted by the version control node. 

171 . The system of claim 170 wherein the particular client node stores the part of the particular 
copy in a storage device which is physically located locally to the particular client node. 
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172. The system of claim 170 wherein the particular client node issues a request to the remote 
file server node to confirm that at least a part of the particular file is the most updated version, 
and 

wherein the remote file server node, in response to determining that the one file is the 
particular file, forwards the message to the version control node. 

173. The system of claim 172 wherein the particular client node, in response to receiving a 
response from the version control node, issues further messages pertaining to version of the 
particular file directly from the particular client node to the version control node. 

174. The system of claim 173 wherein in response to modifying the particular file, the particular 
client node issues to the version control node a version update message for the file indicating a 
recent update has occurred on the particular file. 

175. The system of claim 169 wherein the version control node is also the access control node 
for the particular file. 

176. The system of claim 165 wherein the particular client node is also configured for 
compressing the information of the file prior to uploading the file or decompressing the 
information of the file subsequent to downloading the file. 
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